CVE-2015-2959

CVE-2015-2959 affects Zoho NetFlow Analyzer builds up to and including 10250. The vulnerability is an authorization control failure where the product does not check for administrative authorization, enabling a guest-privileged user to obtain sensitive information, modify passwords, or delete acco...

CVE-2015-2960

NetFlow Analyzer (Zoho) is affected by a Cross-site scripting (XSS) vulnerability in builds 10250 and earlier. The flaw allows remote attackers to cause arbitrary script execution in users’ browsers via unspecified vectors. Affected product: Zoho NetFlow Analyzer; vulnerable component is the web ...

PT-2015-6584

Name of the Vulnerable Software and Affected Versions Zoho NetFlow Analyzer versions prior to build 10250 Description The issue makes it easier for remote attackers to obtain access by leveraging an unattended workstation, as the password field lacks an off autocomplete attribute. Recommendations...

PT-2015-6008

Name of the Vulnerable Software and Affected Versions Zoho NetFlow Analyzer versions prior to build 10250 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For versions prior to build 10250, update ...

PT-2015-6007

Name of the Vulnerable Software and Affected Versions Zoho NetFlow Analyzer versions 10250 and earlier Description The issue allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role, due to a lack of administrative authorization...

PT-2015-6009

Name of the Vulnerable Software and Affected Versions Zoho NetFlow Analyzer versions prior to build 10250 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators. Recommendations For versions prior to build 10250, update to a...

CVE-2015-2959

Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role...

CVE-2015-2960: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

ZOHO NetFlow Analyzer Cross-Site Request Forgery Vulnerability

ZOHO NetFlow Analyzer is a set of network traffic analysis software. The software provides bandwidth monitoring and flow analysis, network forensics and security analysis. ZOHO NetFlow Analyzer suffers from cross-site request forgery, which allows remote attackers to construct malicious URIs,...

CVE-2015-2961

CVE-2015-2961 is a CSRF vulnerability in Zoho NetFlow Analyzer, affecting build 10250 and earlier. An attacker could hijack administrator authentication by inducing a logged-in admin to perform unintended actions via a malicious page. The connected sources clearly state the impact and that the fi...

CVE-2015-4418: Improper Access Control

Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2015-2961: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators...

CVE-2015-4418

CVE-2015-4418 affects Zoho NetFlow Analyzer builds 10250 and earlier. The vulnerability stems from the password field not setting autocomplete to off, enabling potential unauthorized access when an unattended workstation is used. The connected sources (NVD/NVD-like records) corroborate this descr...

NetFlow Analyzer vulnerable to cross-site scripting

Overview NetFlow Analyzer provided by Zoho Corporation contains a cross-site scripting vulnerability. Tomoshige Hasegawa, Akihito Mukai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may...

JVN#98447310: NetFlow Analyzer vulnerable to cross-site scripting

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software build and apply the patch Update the software to build 10250...

JVN#79284156: NetFlow Analyzer vulnerable to cross-site request forgery

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer contains a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged in, various administrative functions may be performed. Solution Update the software build and apply...

JVN#25598413: NetFlow Analyzer fails to restrict access permissions

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer fails to restrict access permissions. Impact Administrative operations, for example, changing passwords or user account deletion may be performed by a user with guest privileges. In addition, information...

ManageEngine AssetExplorer Detection (HTTP)

HTTP based detection of ManageEngine AssetExplorer. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

ZOHO ManageEngine OpManager 'multipartRequest' Servlet Denial of Service Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. The software provides monitoring configuration, alarms and notifications, monitoring reports and other functions. A remote denial of service vulnerability exists in ZOHO ManageEngine OpManage...

Cross-Site Request Forgery (CSRF) Vulnerability in ManageEngine Network Configuration

Title:- Cross-Site Request Forgery CSRF Vulnerability in ManageEngine Network Configuration Management Author: Kaustubh G. Padwad Vendor: ZOHO Corp Product: ManageEngine Network Configuration Manager Tested Version: : Network Configuration Manager Build 11000 Severity: HIGH About the Product:...